Administration of personal data
Gruenpharma Ltd is a young, dynamic and ambitious company and it is active on the market of production and trade of food supplements. Production activities are based in Germany which guarantees the high quality of our products.
We are registered under the Commercial register by Unique Identifier No 205361483, and we are seated at 37 Khan Asparuh str., fl.2, apt. 5, Sofia, Bulgaria, website: www.gruenpharma.com
Independent Supervisory Authority
Personal Data Supervisor: Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov str
Contact details: www.cpdp.bg or phone number +359 02/915 35 18.
All definitions used are identical in meaning under Regulation 2016/679 (EU)
‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
‘Processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law
‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller
Principles of processing personal data
We respect and follow all principles of processing personal data as stipulated by Regulation (EU) 2016/679:
processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);
adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
Categories of personal data we process
• Personal information such as name, Personal Identification Number (PIN), date of birth, sex/gender;
• Contact information such as mailing address, e-mail address, phone numbers;
• Bank information such as credit/debit card numbers in relation to a specified deal or series of deals;
• Technical information such as those generated pursuant to using our website or integrated applications plug-ins, etc;
• Information related to materials and communication received by you or sent to you via e-communication.
Processing special categories of personal data („sensitive data“)
We do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. In case such data is received, it is immediately deleted.
Sources and means of collecting personal data
Personal data provided by you:
In contacting us through contact option on the website or elsewhere, you provide personal data about: your names, phone number and e-mail for contact, residential address for delivery, etc. in relation to a specific order. Such data is processed for the purpose of communication, purchase communication exchange and obtaining information of the offered products.
Data automatically collected through “cookies”
By visiting our website, we automatically collect the following data:
• IP address (IP) of the device used for accessing the platform (usually used for identifying the country/city of accessing the platform);
• Type of the device accessing the platform (i.e. computer, mobile phone, tablet, etc.);
• Type of OS;
• Type of browser;
• Specific activities such as web pages visited, frequency and duration or visits at the website, etc.;
• Date and time of visit;
• At using the information collected, the Collector does not perform profiling of the natural persons. For more information on the cookies used by us, please read our “Cookies policy”.
Purposes of processing personal data
We process your personal data for various purposes provided that such processing is lawfully justified. Specifically, we process personal data for one or several of the following purposes:
• Activities prior to concluding a contract – providing offers or other information required by you;
• Delivery of products, chosen by you;
• Providing information about the goods and products of the company;
• Execution of duties and liabilities under the incumbent legislation;
• Labour Code relations;
• For the purposes of accountancy;
• For the purposes of statistics.
We process your personal data collected automatically through cookies for the following purposes:
• Enhancing the effectiveness and functionality of our website;
• Collecting anonymous statistical data for the way the website is used.
In relation to concluding and execution of contracts
We collect and process you personal data in relation to concluding and executing contractual liabilities under agreements signed with you and in cases where:
• Issue orders, invoices, credit/debit notices and protocols of delivery of services or goods;
• Supervise payments of orders made by you;
• Scrutinize and analyse complaints in relation to our goods and services.
We are entitled to processing your personal data in case we have legitimate interest in doing so, as for in the following cases:
• To continually enhance and develop the quality of products and services offered by us, their functionality, design and/or content;
• To observe and analyse our performance on the market;
• To develop the skills of personnel and subcontractors to deal with clients on the market;
• To personalize our products and services aiming at your satisfaction from the goods and services we provide and the communication with us;
• To supervise the technical status of our information systems and resources, including our e-shops and other web resources and to maintain technical problems in relation to their functioning, security and integrity;
We may collect and process your personal data by your explicit consent in the following cases:
• For the purposes of direct marketing of goods and services offered by us or persons related to us. Direct marketing may be performed by phone calls, sending mail or short messaging, i.e. in case you subscribe tour newsletter or explicitly give consent to receive promotional offers. In such cases we may ask you to provide personal data such as full name, phone number, e-mail address or other relevant information.
In case you are no longer willing to obtain promotional offers and/or marketing messages, you are free to inform us at any time about your decision or just follow the instructions for “unsubscribe” contained in the communication between us. We shall start measures for restricting the marketing content to a reasonable volume by sending you only the content we consider interesting for you or relevant to you on the basis of information we dispose of. You are entitled to retrieve your consent for processing your personal data at any time.
We collect your personal data in our capacity of employer, for the purpose of recruiting personnel and for performing our obligations related to:
– Collecting and considering CVs of applicants for job positions with our company. Such personal data is provided voluntarily by the applicants. The applicants, at their discretion, provide their personal data in the CV or a motivation letter. The data is processed within a month pursuant to expiring the recruitment period. The recruitment period expires by concluding a labour contract with the selected applicant and the relevant personal data, legally required, is collected by them. The data is processed for the purpose of executing the labour contract by the Collector in his capacity of Employer. After the selection of applicants, the personal data is deleted or returned to the applicant, as legally stipulated.
– For the purposes of social security of employees and subcontractors, including liabilities under the Social Security Code, Health Security Code and legislation pertaining to taxation of natural persons or the relevant legislation in other EU member states.
In our capacity of a counterparty to various commercial agreements we collect and process personal data for the following purposes:
• Legitimate accounting of economic activities we are involved in, including taxation of deal on goods and services;
• Duties to cooperate with the competent authorities in the process of executed checks and inspections and in all cases when the authorities perform their supervisory powers as stipulated by the law;
• Involvement in law suits and the related judicial procedures in the capacity of a party or a third liable party, as in the case of liability to provide information and data relevant to deliberating a law case.
Terms of storing the personal data
We process your personal data within the terms legally stipulated by Bulgarian legislation in the powers of the supervisory authorities and within the time limits of the of the purposes for which they are collected. After completion of the purposes and expiry of the legally stipulated interest or basis for processing the personal data (i.e. after retreating the consent for processing specific data), we shall delete it without undue delay.
Criteria on the basis of which the term of storing personal data is determined are:
(а) the period of maintaining commercial relations with the clients and of providing goods and services;
(б) the terms of storing personal data stipulated by the relevant legislation;
(в) the period necessary for storing personal data in relation to our involvement and protection of our rights and legitimate interests in judicial and administrative procedures and the expiry of the relevant limitation periods. Personal data for which there is no express legal or supervisory duty for storing shall be deleted after completing the purposes of its collection.
Mandatory and voluntary nature of providing personal data
The collection of personal data is determined by and serves the purposes of completing your order. Personal data required is reduced to the minimum, following the “need-to-know” principle. Providing personal data is voluntary. In case you decline to provide the necessary personal data, we may not be able to provide the products chosen by you.
Protection of personal data
For protecting your personal data we have taken the necessary technical and organizational measures for protecting it from accidental or illegal deletion, accidental loss, illegal access, distortion or dissemination as well as all other illegal forms of processing.
Processing of personal data
In the capacity of Collector of personal data we process it through a multitude of activities performed by automatic or non-automatic devices. It is possible we process personal data unilaterally or by subcontracting to a third party. At registering on our web page we need you to declare that you are not a person under the age of 14.
Beneficiaries whose personal data is liable to disclosure
Our company, in its capacity of Processor of personal data, might provide information to third parties in performing our legal duties or in protecting our legitimate interests. Third parties include:
• State authorities such as the National Agency on Revenues, Patent authorities, the Company Register, etc.;
• Third party processors of personal data providing services related to the performance of our business activities, such as accountancy companies, logistics companies and others, for the purpose of performing our legitimate interests.
Right of access. You are entitled to the right of receiving information and demand access to data processed by us and related to you.
Right to rectification. You are entitled to the right to require from us corrections of inaccurate personal data.
Right to erasure. You are entitled to the right to require from us to delete your personal data processed by us or to delete it yourself by deleting your profile on our website (“right to be forgotten”).
Right to restriction of processing. You are entitled to the right to require from us a restriction on processing the personal data provided by you.
Retrieval of consent. You are entitled to the right to retrieve your voluntary consent for processing your personal data. We would like to inform you that retrieving your consent does not affect the legitimacy of processing personal data prior to the retrieval.
Right to data portability. You are entitled to the right to receive personal data concerning you and obtained from you.
Right to object. You are entitled to the right to object at any time to collecting and processing of your personal data.
Right to lodge a complaint at the supervisory authority. You are entitled to the right to lodge a complaint to the Commission for Personal Data Protection in case you consider that we are violating any of the legislative requirements for processing personal data
Contact details of the Commission for Personal Data Protection
address: Sofia, postal code 1592, 2 Prof. Tsvetan Lazarov str
More contact details – on the website of the Commission: www.cpdp.bg
Links, tools and content from other companies